Privacy Policy

1. Who this policy covers

This policy explains how the independent individual operator of StudioTasker (“StudioTasker”, “we”, “us”) handles personal data in connection with the StudioTasker website, studio-owner accounts, subscription administration, security and support. The operator is based in Türkiye.

When a studio uses StudioTasker to manage its own members, leads or staff, the studio generally determines why that information is processed and acts as controller. StudioTasker processes that data on the studio’s behalf under the Data Processing Agreement.

2. Data we may collect

• Account data: name or studio name, business email, role, authentication and verification information.
• Subscription data: plan, subscription status, provider identifiers and billing metadata. StudioTasker does not store full payment-card details.
• Workspace data: studio settings, classes, member/lead records, bookings, attendance, credits, tasks, notes and uploaded studio logo.
• Technical and security data: session identifiers, IP-derived security/audit information, user agent, timestamps, error and security events.
• Communications: support or legal correspondence sent to us.

3. Why we use data

Depending on the context, we process data to perform our contract, comply with legal obligations, protect the service and our legitimate interests, and where required, on the basis of consent.

• create and secure accounts;
• provide, maintain and personalise the StudioTasker workspace;
• administer subscriptions and prevent billing fraud;
• send verification, password-reset and essential service messages;
• protect tenant isolation, investigate abuse and maintain audit evidence;
• respond to support, privacy and legal requests;
• meet tax, accounting, compliance and dispute-resolution obligations.

4. Studio member data

StudioTasker does not independently decide the business purpose for a studio’s member CRM, class or booking data. Customer is responsible for its own privacy notices, lawful basis, retention decisions and responses to its members. StudioTasker processes such data only to provide the contracted service and documented instructions, subject to the DPA.

5. Sharing, processors and Paddle

We may use processors to host the application, send transactional account email, maintain backups or support service security. Current processors are listed on the Subprocessors page. We do not sell personal data to advertisers.

Subscription checkout is different: Paddle acts as StudioTasker’s authorised reseller and Merchant of Record. For buyer/payment data used for checkout, payment processing, fraud prevention, tax, invoicing, refunds and regulatory compliance, Paddle and StudioTasker act as independent controllers for their respective purposes rather than Paddle acting as StudioTasker’s processor. StudioTasker receives only the buyer/subscription information reasonably needed to provision the service, administer the subscription, reconcile support and protect against abuse. Full card details are not stored in the StudioTasker application database.

We may also disclose information where required by law or reasonably necessary to protect rights, security or the integrity of the service.

6. International transfers

Where personal data is transferred across countries, StudioTasker uses an appropriate legal transfer mechanism where required. For EEA/UK restricted transfers, this may include applicable adequacy decisions, the European Commission’s Standard Contractual Clauses or another legally recognised safeguard. See the DPA for the controller–processor framework.

7. Retention

We retain account and service information for as long as needed to provide StudioTasker and for legitimate security, accounting, legal and dispute-resolution requirements. Workspace data is retained during the customer relationship and then handled according to the DPA, applicable deletion requests, backup rotation and legal retention obligations.

8. Security

StudioTasker uses technical and organisational measures designed to protect data, including role-based access, tenant isolation, secure sessions, transport encryption in production, encrypted backup procedures and restricted database access. More detail is available in the Security page.

9. Your privacy rights

Depending on applicable law, individuals may have rights to access, correct, delete, restrict or object to processing, request portability, withdraw consent where consent is the basis, and complain to a competent supervisory authority.

If your request concerns information held by a studio about you as its member or client, contact that studio first. StudioTasker will assist the studio where required by the DPA.

10. Children and special-category data

StudioTasker is sold to businesses, not directly to children. A studio is responsible for determining whether it may lawfully process minors’ data. Unless separately agreed and technically supported, customers should not store medical records, diagnoses or other special-category/high-risk information in StudioTasker.

11. Cookies, analytics and browser storage

See the Cookie Policy. The core service uses authentication/session technology that is necessary to keep accounts secure. StudioTasker does not enable Google Analytics, Meta Pixel or behavioural-advertising trackers in the initial production configuration. Paddle’s checkout technology is loaded only when a signed-in owner starts a subscription checkout and is governed by Paddle’s own privacy information for the processing it independently controls.

12. Türkiye privacy transparency

Where Turkish Personal Data Protection Law No. 6698 applies to operator-controlled data, the dedicated Türkiye Privacy Notice (KVKK) explains the relevant collection methods, purposes, legal grounds, recipient groups, transfer framework and Article 11 rights. It is provided as an information notice, not as bundled consent.

13. Contact

The operator is an individual based in Türkiye. Paid checkout remains disabled until the full legal identity, service address, dedicated privacy email and support phone are configured.